Fortigate upgrade: IPsec hashed psk key password hell

Hi folks,

Lately, I've come up with an "issue": Between FortiOS releases the way the hash is managed is different, making it quite difficult to "upgrade" the hashed version of the ipsec phase1 passwords to a newer version when the new hardware cannot be downgraded to match the old hardware.

Some customers still running a Fortigate in version 4.0 or 5.0 want to get a hardware refresh and update. When a new unit arrives it cannot be downgraded to match the customer's version and most of our customer do not want to risk updating their unit as it is at the end of their lives.

So no problems right ? Well, there is one really time consuming task that we are forced to do: Get back a compatible hashed version of the passwords as most of the time customer's don't store the password used in IPsec tunnels. Passwords hashes are not compatible from one release to the next major release and this has been a time consuming task.

The only solution we've found is to downgrade all the way to the customer's version with some random Fortigate lying around and upgrade all the way to the desired final version. The problem is that it sometimes requires the use of two firewalls, one from 4.0 to 5.2 and the final one from 5.2 up to 5.6 (as of now).

So, my question to the community:

Did someone find a better solution to this "problem" ? Like a tool to convert previous version password hashes into ones that are compatible for a desired release ?

Thanks a lot for your feedback